refactor(core): apply v1.5-port cleanups deferred from #1306 (#1316)

* refactor(core): apply v1.5-port cleanups deferred from #1306

Addresses issue #1309 — five small, mechanical cleanups deferred from the
v1.5 runtime port:

1. Collapse BrowserOAuthStorage / NodeOAuthStorage / RemoteOAuthStorage
   onto a shared OAuthStorageBase. Three ~130-line duplicates become
   thin adapter wrappers; behavior + public API unchanged.
2. Re-enable erasableSyntaxOnly in tsconfig.app.json by rewriting the
   seven (plus two the issue missed in sampling/elicitation create-
   message) parameter-property constructors as explicit field + assign.
3. Route the lone console.error in inspectorClient.ts through this.logger.
4. Replace `${Date.now()}-${Math.random()}` with crypto.randomUUID() at
   the five local-only ID sites (message tracking + sampling/elicit).
5. Pin the remote-server hono app generic at new Hono<Env>() and drop
   the streamSSE cast. Root cause of the cast was an unresolved hono
   subpath: the tsconfig "hono/*" wildcard didn't honor the exports
   map, so hono/streaming leaked to the root-hoisted hono@4.12.12 while
   hono itself resolved to clients/web/hono@4.12.18. Replaced the
   wildcard with an explicit hono/streaming entry in both tsconfig.app
   and tsconfig.test, removing the package-identity mismatch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(core): address #1316 PR review feedback

- Drop the stranded no-op getServerState() read at the top of
  clearClientInformation in OAuthStorageBase (carried over verbatim
  from the three originals).
- Drop the crypto.randomUUID() guard at the task-ID site so all
  six in-scope sites are consistent; the fallback branch was dead
  code on every supported runtime.
- Remove the residual `c as Context` cast at the streamSSE call site
  in core/mcp/remote/node/server.ts — once both hono imports
  resolve to the same package the route-typed Context flows through
  to streamSSE with no cast at all.
- Move the new `options` / `config` field declarations in
  RemoteClientTransport up with the rest of the field block, matching
  the layout used by the other five rewritten classes in this PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

clients/web/tsconfig.app.json

@@ -20,11 +20,7 @@
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
-    /* erasableSyntaxOnly disabled: the ported v1.5 core/ subsystem (#1302)
+    "erasableSyntaxOnly": true,
-     * uses TS parameter properties (`constructor(private foo: T)`) extensively.
-     * Re-enable once we either rewrite those constructors or move core/ to
-     * a separate tsconfig with looser rules. */
-    "erasableSyntaxOnly": false,
     "noFallthroughCasesInSwitch": true,
     "noUncheckedSideEffectImports": true,
 
@@ -44,7 +40,9 @@
       "zustand": ["./node_modules/zustand"],
       "zustand/*": ["./node_modules/zustand/*"],
       "hono": ["./node_modules/hono"],
-      "hono/*": ["./node_modules/hono/*"],
+      "hono/streaming": [
+        "./node_modules/hono/dist/types/helper/streaming/index"
+      ],
       "@hono/node-server": ["./node_modules/@hono/node-server"],
       "atomically": ["./node_modules/atomically"]
     }

clients/web/tsconfig.test.json

@@ -14,7 +14,9 @@
       "zustand": ["./node_modules/zustand"],
       "zustand/*": ["./node_modules/zustand/*"],
       "hono": ["./node_modules/hono"],
-      "hono/*": ["./node_modules/hono/*"],
+      "hono/streaming": [
+        "./node_modules/hono/dist/types/helper/streaming/index"
+      ],
       "@hono/node-server": ["./node_modules/@hono/node-server"],
       "atomically": ["./node_modules/atomically"],
       "express": ["./node_modules/@types/express"],

core/auth/browser/storage.ts

@@ -1,145 +1,15 @@
 import { createJSONStorage } from "zustand/middleware";
-import type { OAuthStorage } from "../storage.js";
+import { OAuthStorageBase } from "../oauth-storage.js";
-import type {
+import { createOAuthStore } from "../store.js";
-  OAuthClientInformation,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import {
-  OAuthClientInformationSchema,
-  OAuthTokensSchema,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import { createOAuthStore, type ServerOAuthState } from "../store.js";
 
 /**
  * Browser storage implementation using Zustand with sessionStorage.
  * For web client (can be used by InspectorClient in browser).
  */
-export class BrowserOAuthStorage implements OAuthStorage {
+export class BrowserOAuthStorage extends OAuthStorageBase {
-  private store: ReturnType<typeof createOAuthStore>;
-
   constructor() {
     // Use Zustand's built-in sessionStorage adapter
     // The `name` option in persist() ("mcp-inspector-oauth") becomes the sessionStorage key
-    const storage = createJSONStorage(() => sessionStorage);
+    super(createOAuthStore(createJSONStorage(() => sessionStorage)));
-    this.store = createOAuthStore(storage);
-  }
-  async getClientInformation(
-    serverUrl: string,
-    isPreregistered?: boolean,
-  ): Promise<OAuthClientInformation | undefined> {
-    const state = this.store.getState().getServerState(serverUrl);
-    const clientInfo = isPreregistered
-      ? state.preregisteredClientInformation
-      : state.clientInformation;
-
-    if (!clientInfo) {
-      return undefined;
-    }
-
-    return await OAuthClientInformationSchema.parseAsync(clientInfo);
-  }
-
-  async saveClientInformation(
-    serverUrl: string,
-    clientInformation: OAuthClientInformation,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, {
-      clientInformation,
-    });
-  }
-
-  async savePreregisteredClientInformation(
-    serverUrl: string,
-    clientInformation: OAuthClientInformation,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, {
-      preregisteredClientInformation: clientInformation,
-    });
-  }
-
-  clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
-    this.store.getState().getServerState(serverUrl);
-    const updates: Partial<ServerOAuthState> = {};
-
-    if (isPreregistered) {
-      updates.preregisteredClientInformation = undefined;
-    } else {
-      updates.clientInformation = undefined;
-    }
-
-    this.store.getState().setServerState(serverUrl, updates);
-  }
-
-  async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
-    const state = this.store.getState().getServerState(serverUrl);
-    if (!state.tokens) {
-      return undefined;
-    }
-
-    return await OAuthTokensSchema.parseAsync(state.tokens);
-  }
-
-  async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { tokens });
-  }
-
-  clearTokens(serverUrl: string): void {
-    this.store.getState().setServerState(serverUrl, { tokens: undefined });
-  }
-
-  getCodeVerifier(serverUrl: string): string | undefined {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.codeVerifier;
-  }
-
-  async saveCodeVerifier(
-    serverUrl: string,
-    codeVerifier: string,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { codeVerifier });
-  }
-
-  clearCodeVerifier(serverUrl: string): void {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { codeVerifier: undefined });
-  }
-
-  getScope(serverUrl: string): string | undefined {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.scope;
-  }
-
-  async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { scope });
-  }
-
-  clearScope(serverUrl: string): void {
-    this.store.getState().setServerState(serverUrl, { scope: undefined });
-  }
-
-  getServerMetadata(serverUrl: string): OAuthMetadata | null {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.serverMetadata || null;
-  }
-
-  async saveServerMetadata(
-    serverUrl: string,
-    metadata: OAuthMetadata,
-  ): Promise<void> {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { serverMetadata: metadata });
-  }
-
-  clearServerMetadata(serverUrl: string): void {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { serverMetadata: undefined });
-  }
-
-  clear(serverUrl: string): void {
-    this.store.getState().clearServerState(serverUrl);
   }
 }

core/auth/node/storage-node.ts

@@ -1,14 +1,5 @@
-import type { OAuthStorage } from "../storage.js";
+import { OAuthStorageBase } from "../oauth-storage.js";
-import type {
+import { createOAuthStore } from "../store.js";
-  OAuthClientInformation,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import {
-  OAuthClientInformationSchema,
-  OAuthTokensSchema,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import { createOAuthStore, type ServerOAuthState } from "../store.js";
 import { createFileStorageAdapter } from "../../storage/adapters/file-storage.js";
 import {
   getDefaultStorageDir,
@@ -59,135 +50,14 @@ export function clearAllOAuthClientState(): void {
 }
 
 /**
- * Node.js storage implementation using Zustand with file-based persistence
+ * Node.js storage implementation using Zustand with file-based persistence.
- * For InspectorClient, CLI, and TUI
+ * For InspectorClient, CLI, and TUI.
  */
-export class NodeOAuthStorage implements OAuthStorage {
+export class NodeOAuthStorage extends OAuthStorageBase {
-  private store: ReturnType<typeof getOAuthStore>;
-
   /**
    * @param storagePath - Optional path to state file. Default: ~/.mcp-inspector/oauth/state.json
    */
   constructor(storagePath?: string) {
-    this.store = getOAuthStore(storagePath);
+    super(getOAuthStore(storagePath));
-  }
-
-  async getClientInformation(
-    serverUrl: string,
-    isPreregistered?: boolean,
-  ): Promise<OAuthClientInformation | undefined> {
-    const state = this.store.getState().getServerState(serverUrl);
-    const clientInfo = isPreregistered
-      ? state.preregisteredClientInformation
-      : state.clientInformation;
-
-    if (!clientInfo) {
-      return undefined;
-    }
-
-    return await OAuthClientInformationSchema.parseAsync(clientInfo);
-  }
-
-  async saveClientInformation(
-    serverUrl: string,
-    clientInformation: OAuthClientInformation,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, {
-      clientInformation,
-    });
-  }
-
-  async savePreregisteredClientInformation(
-    serverUrl: string,
-    clientInformation: OAuthClientInformation,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, {
-      preregisteredClientInformation: clientInformation,
-    });
-  }
-
-  clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
-    this.store.getState().getServerState(serverUrl);
-    const updates: Partial<ServerOAuthState> = {};
-
-    if (isPreregistered) {
-      updates.preregisteredClientInformation = undefined;
-    } else {
-      updates.clientInformation = undefined;
-    }
-
-    this.store.getState().setServerState(serverUrl, updates);
-  }
-
-  async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
-    const state = this.store.getState().getServerState(serverUrl);
-    if (!state.tokens) {
-      return undefined;
-    }
-
-    return await OAuthTokensSchema.parseAsync(state.tokens);
-  }
-
-  async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { tokens });
-  }
-
-  clearTokens(serverUrl: string): void {
-    this.store.getState().setServerState(serverUrl, { tokens: undefined });
-  }
-
-  getCodeVerifier(serverUrl: string): string | undefined {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.codeVerifier;
-  }
-
-  async saveCodeVerifier(
-    serverUrl: string,
-    codeVerifier: string,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { codeVerifier });
-  }
-
-  clearCodeVerifier(serverUrl: string): void {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { codeVerifier: undefined });
-  }
-
-  getScope(serverUrl: string): string | undefined {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.scope;
-  }
-
-  async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { scope });
-  }
-
-  clearScope(serverUrl: string): void {
-    this.store.getState().setServerState(serverUrl, { scope: undefined });
-  }
-
-  getServerMetadata(serverUrl: string): OAuthMetadata | null {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.serverMetadata || null;
-  }
-
-  async saveServerMetadata(
-    serverUrl: string,
-    metadata: OAuthMetadata,
-  ): Promise<void> {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { serverMetadata: metadata });
-  }
-
-  clearServerMetadata(serverUrl: string): void {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { serverMetadata: undefined });
-  }
-
-  clear(serverUrl: string): void {
-    this.store.getState().clearServerState(serverUrl);
   }
 }

core/auth/oauth-storage.ts

@@ -0,0 +1,142 @@
+import type {
+  OAuthClientInformation,
+  OAuthTokens,
+  OAuthMetadata,
+} from "@modelcontextprotocol/sdk/shared/auth.js";
+import {
+  OAuthClientInformationSchema,
+  OAuthTokensSchema,
+} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthStorage } from "./storage.js";
+import { type createOAuthStore, type ServerOAuthState } from "./store.js";
+
+/**
+ * Concrete OAuthStorage implementation parameterized on a Zustand store.
+ * The store carries the storage adapter (sessionStorage, file, remote HTTP, …),
+ * so the same body works for browser, Node, and remote environments.
+ */
+export class OAuthStorageBase implements OAuthStorage {
+  private readonly store: ReturnType<typeof createOAuthStore>;
+
+  constructor(store: ReturnType<typeof createOAuthStore>) {
+    this.store = store;
+  }
+
+  async getClientInformation(
+    serverUrl: string,
+    isPreregistered?: boolean,
+  ): Promise<OAuthClientInformation | undefined> {
+    const state = this.store.getState().getServerState(serverUrl);
+    const clientInfo = isPreregistered
+      ? state.preregisteredClientInformation
+      : state.clientInformation;
+
+    if (!clientInfo) {
+      return undefined;
+    }
+
+    return await OAuthClientInformationSchema.parseAsync(clientInfo);
+  }
+
+  async saveClientInformation(
+    serverUrl: string,
+    clientInformation: OAuthClientInformation,
+  ): Promise<void> {
+    this.store.getState().setServerState(serverUrl, {
+      clientInformation,
+    });
+  }
+
+  async savePreregisteredClientInformation(
+    serverUrl: string,
+    clientInformation: OAuthClientInformation,
+  ): Promise<void> {
+    this.store.getState().setServerState(serverUrl, {
+      preregisteredClientInformation: clientInformation,
+    });
+  }
+
+  clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
+    const updates: Partial<ServerOAuthState> = {};
+
+    if (isPreregistered) {
+      updates.preregisteredClientInformation = undefined;
+    } else {
+      updates.clientInformation = undefined;
+    }
+
+    this.store.getState().setServerState(serverUrl, updates);
+  }
+
+  async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
+    const state = this.store.getState().getServerState(serverUrl);
+    if (!state.tokens) {
+      return undefined;
+    }
+
+    return await OAuthTokensSchema.parseAsync(state.tokens);
+  }
+
+  async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
+    this.store.getState().setServerState(serverUrl, { tokens });
+  }
+
+  clearTokens(serverUrl: string): void {
+    this.store.getState().setServerState(serverUrl, { tokens: undefined });
+  }
+
+  getCodeVerifier(serverUrl: string): string | undefined {
+    const state = this.store.getState().getServerState(serverUrl);
+    return state.codeVerifier;
+  }
+
+  async saveCodeVerifier(
+    serverUrl: string,
+    codeVerifier: string,
+  ): Promise<void> {
+    this.store.getState().setServerState(serverUrl, { codeVerifier });
+  }
+
+  clearCodeVerifier(serverUrl: string): void {
+    this.store
+      .getState()
+      .setServerState(serverUrl, { codeVerifier: undefined });
+  }
+
+  getScope(serverUrl: string): string | undefined {
+    const state = this.store.getState().getServerState(serverUrl);
+    return state.scope;
+  }
+
+  async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
+    this.store.getState().setServerState(serverUrl, { scope });
+  }
+
+  clearScope(serverUrl: string): void {
+    this.store.getState().setServerState(serverUrl, { scope: undefined });
+  }
+
+  getServerMetadata(serverUrl: string): OAuthMetadata | null {
+    const state = this.store.getState().getServerState(serverUrl);
+    return state.serverMetadata || null;
+  }
+
+  async saveServerMetadata(
+    serverUrl: string,
+    metadata: OAuthMetadata,
+  ): Promise<void> {
+    this.store
+      .getState()
+      .setServerState(serverUrl, { serverMetadata: metadata });
+  }
+
+  clearServerMetadata(serverUrl: string): void {
+    this.store
+      .getState()
+      .setServerState(serverUrl, { serverMetadata: undefined });
+  }
+
+  clear(serverUrl: string): void {
+    this.store.getState().clearServerState(serverUrl);
+  }
+}

core/auth/providers.ts

@@ -51,8 +51,11 @@ export type OAuthNavigationCallback = (
  */
 export class CallbackNavigation implements OAuthNavigation {
   private authorizationUrl: URL | null = null;
+  private callback: OAuthNavigationCallback;
 
-  constructor(private callback: OAuthNavigationCallback) {}
+  constructor(callback: OAuthNavigationCallback) {
+    this.callback = callback;
+  }
 
   navigateToAuthorization(authorizationUrl: URL): void {
     this.authorizationUrl = authorizationUrl;
@@ -100,6 +103,7 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
   private capturedAuthUrl: URL | null = null;
   private eventTarget: EventTarget | null = null;
 
+  protected serverUrl: string;
   protected storage: OAuthStorage;
   protected redirectUrlProvider: RedirectUrlProvider;
   protected navigation: OAuthNavigation;
@@ -107,10 +111,11 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
   protected mode: "normal" | "guided";
 
   constructor(
-    protected serverUrl: string,
+    serverUrl: string,
     oauthConfig: OAuthProviderConfig,
     mode: "normal" | "guided" = "normal",
   ) {
+    this.serverUrl = serverUrl;
     this.storage = oauthConfig.storage;
     this.redirectUrlProvider = oauthConfig.redirectUrlProvider;
     this.navigation = oauthConfig.navigation;

core/auth/remote/storage-remote.ts

@@ -4,17 +4,8 @@
  * For web clients that need to share state with Node apps.
  */
 
-import type { OAuthStorage } from "../storage.js";
+import { OAuthStorageBase } from "../oauth-storage.js";
-import type {
+import { createOAuthStore } from "../store.js";
-  OAuthClientInformation,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import {
-  OAuthClientInformationSchema,
-  OAuthTokensSchema,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import { createOAuthStore, type ServerOAuthState } from "../store.js";
 import { createRemoteStorageAdapter } from "../../storage/adapters/remote-storage.js";
 
 export interface RemoteOAuthStorageOptions {
@@ -33,135 +24,17 @@ export interface RemoteOAuthStorageOptions {
  * Stores OAuth state via HTTP API (GET/POST/DELETE /api/storage/:storeId).
  * For web clients that need to share state with Node apps (TUI, CLI).
  */
-export class RemoteOAuthStorage implements OAuthStorage {
+export class RemoteOAuthStorage extends OAuthStorageBase {
-  private store: ReturnType<typeof createOAuthStore>;
-
   constructor(options: RemoteOAuthStorageOptions) {
-    const storage = createRemoteStorageAdapter({
+    super(
-      baseUrl: options.baseUrl,
+      createOAuthStore(
-      storeId: options.storeId ?? "oauth",
+        createRemoteStorageAdapter({
-      authToken: options.authToken,
+          baseUrl: options.baseUrl,
-      fetchFn: options.fetchFn,
+          storeId: options.storeId ?? "oauth",
-    });
+          authToken: options.authToken,
-    this.store = createOAuthStore(storage);
+          fetchFn: options.fetchFn,
-  }
+        }),
-
+      ),
-  async getClientInformation(
+    );
-    serverUrl: string,
-    isPreregistered?: boolean,
-  ): Promise<OAuthClientInformation | undefined> {
-    const state = this.store.getState().getServerState(serverUrl);
-    const clientInfo = isPreregistered
-      ? state.preregisteredClientInformation
-      : state.clientInformation;
-
-    if (!clientInfo) {
-      return undefined;
-    }
-
-    return await OAuthClientInformationSchema.parseAsync(clientInfo);
-  }
-
-  async saveClientInformation(
-    serverUrl: string,
-    clientInformation: OAuthClientInformation,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, {
-      clientInformation,
-    });
-  }
-
-  async savePreregisteredClientInformation(
-    serverUrl: string,
-    clientInformation: OAuthClientInformation,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, {
-      preregisteredClientInformation: clientInformation,
-    });
-  }
-
-  clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
-    this.store.getState().getServerState(serverUrl);
-    const updates: Partial<ServerOAuthState> = {};
-
-    if (isPreregistered) {
-      updates.preregisteredClientInformation = undefined;
-    } else {
-      updates.clientInformation = undefined;
-    }
-
-    this.store.getState().setServerState(serverUrl, updates);
-  }
-
-  async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
-    const state = this.store.getState().getServerState(serverUrl);
-    if (!state.tokens) {
-      return undefined;
-    }
-
-    return await OAuthTokensSchema.parseAsync(state.tokens);
-  }
-
-  async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { tokens });
-  }
-
-  clearTokens(serverUrl: string): void {
-    this.store.getState().setServerState(serverUrl, { tokens: undefined });
-  }
-
-  getCodeVerifier(serverUrl: string): string | undefined {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.codeVerifier;
-  }
-
-  async saveCodeVerifier(
-    serverUrl: string,
-    codeVerifier: string,
-  ): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { codeVerifier });
-  }
-
-  clearCodeVerifier(serverUrl: string): void {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { codeVerifier: undefined });
-  }
-
-  getScope(serverUrl: string): string | undefined {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.scope;
-  }
-
-  async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
-    this.store.getState().setServerState(serverUrl, { scope });
-  }
-
-  clearScope(serverUrl: string): void {
-    this.store.getState().setServerState(serverUrl, { scope: undefined });
-  }
-
-  getServerMetadata(serverUrl: string): OAuthMetadata | null {
-    const state = this.store.getState().getServerState(serverUrl);
-    return state.serverMetadata || null;
-  }
-
-  async saveServerMetadata(
-    serverUrl: string,
-    metadata: OAuthMetadata,
-  ): Promise<void> {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { serverMetadata: metadata });
-  }
-
-  clearServerMetadata(serverUrl: string): void {
-    this.store
-      .getState()
-      .setServerState(serverUrl, { serverMetadata: undefined });
-  }
-
-  clear(serverUrl: string): void {
-    this.store.getState().clearServerState(serverUrl);
   }
 }

core/auth/state-machine.ts

@@ -256,12 +256,22 @@ export const oauthTransitions: Record<OAuthStep, StateTransition> = {
 };
 
 export class OAuthStateMachine {
+  private serverUrl: string;
+  private provider: BaseOAuthClientProvider;
+  private updateState: (updates: Partial<AuthGuidedState>) => void;
+  private fetchFn?: typeof fetch;
+
   constructor(
-    private serverUrl: string,
+    serverUrl: string,
-    private provider: BaseOAuthClientProvider,
+    provider: BaseOAuthClientProvider,
-    private updateState: (updates: Partial<AuthGuidedState>) => void,
+    updateState: (updates: Partial<AuthGuidedState>) => void,
-    private fetchFn?: typeof fetch,
+    fetchFn?: typeof fetch,
-  ) {}
+  ) {
+    this.serverUrl = serverUrl;
+    this.provider = provider;
+    this.updateState = updateState;
+    this.fetchFn = fetchFn;
+  }
 
   async executeStep(state: AuthGuidedState): Promise<void> {
     const context: StateMachineContext = {

core/mcp/elicitationCreateMessage.ts

@@ -29,14 +29,16 @@ export class ElicitationCreateMessage {
   private resolvePromise?: (result: ElicitResult) => void;
   /** Set only for task-augmented elicit; used when user declines so server's tasks/result receives an error */
   private rejectCallback?: (error: Error) => void;
+  private onRemove: (id: string) => void;
 
   constructor(
     request: ElicitRequest,
     resolve: (result: ElicitResult) => void,
-    private onRemove: (id: string) => void,
+    onRemove: (id: string) => void,
     reject?: (error: Error) => void,
   ) {
-    this.id = `elicitation-${Date.now()}-${Math.random()}`;
+    this.onRemove = onRemove;
+    this.id = `elicitation-${crypto.randomUUID()}`;
     this.timestamp = new Date();
     this.request = request;
     // Extract taskId from request params metadata if present

core/mcp/inspectorClient.ts

@@ -174,12 +174,14 @@ export class InspectorClient extends InspectorClientEventTarget {
   private effectiveAuthFetch: typeof fetch;
   // Session ID (for OAuth state and saveSession event; persistence is in FetchRequestLogState)
   private sessionId?: string;
+  private transportConfig: MCPServerConfig;
 
   constructor(
-    private transportConfig: MCPServerConfig,
+    transportConfig: MCPServerConfig,
     options: InspectorClientOptions,
   ) {
     super();
+    this.transportConfig = transportConfig;
     // Extract environment components
     this.transportClientFactory = options.environment.transport;
     this.fetchFn = options.environment.fetch;
@@ -309,7 +311,7 @@ export class InspectorClient extends InspectorClientEventTarget {
     return {
       trackRequest: (message: JSONRPCRequest) => {
         const entry: MessageEntry = {
-          id: `${Date.now()}-${Math.random()}`,
+          id: crypto.randomUUID(),
           timestamp: new Date(),
           direction: "request",
           message,
@@ -320,7 +322,7 @@ export class InspectorClient extends InspectorClientEventTarget {
         message: JSONRPCResultResponse | JSONRPCErrorResponse,
       ) => {
         const entry: MessageEntry = {
-          id: `${Date.now()}-${Math.random()}`,
+          id: crypto.randomUUID(),
           timestamp: new Date(),
           direction: "response",
           message,
@@ -329,7 +331,7 @@ export class InspectorClient extends InspectorClientEventTarget {
       },
       trackNotification: (message: JSONRPCNotification) => {
         const entry: MessageEntry = {
-          id: `${Date.now()}-${Math.random()}`,
+          id: crypto.randomUUID(),
           timestamp: new Date(),
           direction: "notification",
           message,
@@ -415,10 +417,7 @@ export class InspectorClient extends InspectorClientEventTarget {
     statusMessage?: string;
     pollInterval?: number;
   }): ReceiverTaskRecord {
-    const taskId =
+    const taskId = crypto.randomUUID();
-      typeof crypto !== "undefined" && crypto.randomUUID
-        ? crypto.randomUUID()
-        : `task-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
     const ttlMs =
       opts.ttl ??
       (typeof this.receiverTaskTtlMs === "function"
@@ -1962,7 +1961,10 @@ export class InspectorClient extends InspectorClientEventTarget {
       });
     } catch (error) {
       // Log but don't throw - roots were updated locally even if notification failed
-      console.error("Failed to send roots/list_changed notification:", error);
+      this.logger.error(
+        { error },
+        "Failed to send roots/list_changed notification",
+      );
     }
   }
 

core/mcp/messageTrackingTransport.ts

@@ -23,10 +23,16 @@ export interface MessageTrackingCallbacks {
 
 // Transport wrapper that intercepts all messages for tracking
 export class MessageTrackingTransport implements Transport {
+  private baseTransport: Transport;
+  private callbacks: MessageTrackingCallbacks;
+
   constructor(
-    private baseTransport: Transport,
+    baseTransport: Transport,
-    private callbacks: MessageTrackingCallbacks,
+    callbacks: MessageTrackingCallbacks,
-  ) {}
+  ) {
+    this.baseTransport = baseTransport;
+    this.callbacks = callbacks;
+  }
 
   async start(): Promise<void> {
     return this.baseTransport.start();

core/mcp/oauthManager.ts

@@ -41,11 +41,13 @@ export interface OAuthManagerParams {
  * InspectorClient creates this when oauth is configured and delegates all OAuth methods.
  */
 export class OAuthManager {
+  private params: OAuthManagerParams;
   private oauthConfig: OAuthManagerConfig;
   private oauthStateMachine: OAuthStateMachine | null = null;
   private oauthState: AuthGuidedState | null = null;
 
-  constructor(private params: OAuthManagerParams) {
+  constructor(params: OAuthManagerParams) {
+    this.params = params;
     this.oauthConfig = { ...params.initialConfig };
   }
 

core/mcp/remote/node/server.ts

@@ -17,7 +17,7 @@ import {
 } from "../../../storage/store-io.js";
 import type { LogEvent } from "pino";
 import { Hono } from "hono";
-import type { Context, Next } from "hono";
+import type { Context, Env, Next } from "hono";
 import { streamSSE } from "hono/streaming";
 import { createTransportNode } from "../../node/transport.js";
 import type { RemoteConnectRequest, RemoteSendRequest } from "../types.js";
@@ -277,7 +277,7 @@ export function createRemoteApp(
       process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] ||
       randomBytes(32).toString("hex");
 
-  const app = new Hono();
+  const app = new Hono<Env>();
   const sessions = new Map<string, RemoteSession>();
   const { logger: fileLogger, allowedOrigins } = options;
   const storageDir = options.storageDir ?? getDefaultStorageDir();
@@ -453,9 +453,7 @@ export function createRemoteApp(
       return c.json({ error: "Session not found" }, 404);
     }
 
-    // hono's streamSSE generic typing has tightened since v1.5; cast the
+    return streamSSE(c, async (stream) => {
-    // route-typed Context down to the broader Context shape it expects.
-    return streamSSE(c as unknown as Parameters<typeof streamSSE>[0], async (stream) => {
       session.setEventConsumer((event) => {
         const data = JSON.stringify(event);
         void stream.writeSSE({

core/mcp/remote/remoteClientTransport.ts

@@ -99,6 +99,8 @@ export class RemoteClientTransport implements Transport {
     null;
   private eventStreamAbort: AbortController | null = null;
   private closed = false;
+  private readonly options: RemoteTransportOptions;
+  private readonly config: import("../types.js").MCPServerConfig;
 
   /**
    * Intentionally returns undefined. The MCP Client checks transport.sessionId to detect
@@ -112,9 +114,12 @@ export class RemoteClientTransport implements Transport {
   }
 
   constructor(
-    private readonly options: RemoteTransportOptions,
+    options: RemoteTransportOptions,
-    private readonly config: import("../types.js").MCPServerConfig,
+    config: import("../types.js").MCPServerConfig,
-  ) {}
+  ) {
+    this.options = options;
+    this.config = config;
+  }
 
   private get fetchFn(): typeof fetch {
     return this.options.fetchFn ?? globalThis.fetch;

core/mcp/samplingCreateMessage.ts

@@ -28,14 +28,16 @@ export class SamplingCreateMessage {
   public readonly taskId?: string;
   private resolvePromise?: (result: CreateMessageResult) => void;
   private rejectPromise?: (error: Error) => void;
+  private onRemove: (id: string) => void;
 
   constructor(
     request: CreateMessageRequest,
     resolve: (result: CreateMessageResult) => void,
     reject: (error: Error) => void,
-    private onRemove: (id: string) => void,
+    onRemove: (id: string) => void,
   ) {
-    this.id = `sampling-${Date.now()}-${Math.random()}`;
+    this.onRemove = onRemove;
+    this.id = `sampling-${crypto.randomUUID()}`;
     this.timestamp = new Date();
     this.request = request;
     // Extract taskId from request params metadata if present